pf: test set-tos

Introduce tests for the set-tos feature of pf. Teach pft_ping.py to send
and verify ToS flags.

tests/sys/netpfil/pf/Makefile

@@ -5,7 +5,8 @@ PACKAGE=	tests
 TESTSDIR=       ${TESTSBASE}/sys/netpfil/pf
 
 ATF_TESTS_SH+=	pass_block \
-		forward
+		forward \
+		set_tos
 
 ${PACKAGE}FILES+=	utils.subr \
 			pft_ping.py

tests/sys/netpfil/pf/pft_ping.py

@@ -18,7 +18,7 @@ def __init__(self, recvif):
 	def run(self):
 		self.packets = sp.sniff(iface=self._recvif, timeout=3)
 
-def check_ping_request(packet, dst_ip):
+def check_ping_request(packet, dst_ip, args):
 	"""
 	Verify that the packet matches what we'd have sent
 	"""
@@ -40,13 +40,27 @@ def check_ping_request(packet, dst_ip):
 	if raw.load != str(PAYLOAD_MAGIC):
 		return False
 
+	# Wait to check expectations until we've established this is the packet we
+	# sent.
+	if args.expect_tos:
+		if ip.tos != int(args.expect_tos[0]):
+			print "Unexpected ToS value %d, expected %s" \
+				% (ip.tos, args.expect_tos[0])
+			return False
+
+
 	return True
 
-def ping(send_if, dst_ip):
-	req = sp.Ether() \
-		/ sp.IP(dst=dst_ip) \
-		/ sp.ICMP(type='echo-request') \
-		/ sp.Raw(PAYLOAD_MAGIC)
+def ping(send_if, dst_ip, args):
+	ether = sp.Ether()
+	ip = sp.IP(dst=dst_ip)
+	icmp = sp.ICMP(type='echo-request')
+	raw = sp.Raw(PAYLOAD_MAGIC)
+
+	if args.send_tos:
+		ip.tos = int(args.send_tos[0])
+
+	req = ether / ip / icmp / raw
 	sp.sendp(req, iface=send_if, verbose=False)
 
 def main():
@@ -61,19 +75,27 @@ def main():
 		required=True,
 		help='The destination IP address for the ICMP echo request')
 
+	# Packet settings
+	parser.add_argument('--send-tos', nargs=1,
+		help='Set the ToS value for the transmitted packet')
+
+	# Expectations
+	parser.add_argument('--expect-tos', nargs=1,
+		help='The expected ToS value in the received packet')
+
 	args = parser.parse_args()
 
 	sniffer = None
 	if not args.recvif is None:
 		sniffer = Sniffer(args.recvif[0])
 
-	ping(args.sendif[0], args.to[0])
+	ping(args.sendif[0], args.to[0], args)
 
 	if sniffer:
 		sniffer.join()
 
 		for packet in sniffer.packets:
-			if check_ping_request(packet, args.to[0]):
+			if check_ping_request(packet, args.to[0], args):
 				sys.exit(0)
 
 		# We did not get the packet we expected

tests/sys/netpfil/pf/set_tos.sh

@@ -0,0 +1,92 @@
+# $FreeBSD$
+
+. $(atf_get_srcdir)/utils.subr
+
+atf_test_case "v4" "cleanup"
+v4_head()
+{
+	atf_set descr 'set-tos test'
+	atf_set require.user root
+
+	# We need scapy to be installed for out test scripts to work
+	atf_set require.progs scapy
+}
+
+v4_body()
+{
+	pft_init
+
+	epair_send=$(pft_mkepair)
+	ifconfig ${epair_send}a 192.0.2.1/24 up
+
+	epair_recv=$(pft_mkepair)
+	ifconfig ${epair_recv}a up
+
+	pft_mkjail alcatraz ${epair_send}b ${epair_recv}b
+	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
+	jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up
+	jexec alcatraz sysctl net.inet.ip.forwarding=1
+	jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05
+	route add -net 198.51.100.0/24 192.0.2.2
+
+	# No change is done if not requested
+	printf "scrub out proto icmp\n" | jexec alcatraz pfctl -ef -
+	atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \
+		--sendif ${epair_send}a \
+		--to 198.51.100.3 \
+		--recvif ${epair_recv}a \
+		--expect-tos 42
+
+	# The requested ToS is set
+	printf "scrub out proto icmp set-tos 42\n" | jexec alcatraz pfctl -f -
+	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
+		--sendif ${epair_send}a \
+		--to 198.51.100.3 \
+		--recvif ${epair_recv}a \
+		--expect-tos 42
+
+	# ToS is not changed if the scrub rule does not match
+	printf "scrub out proto tcp set-tos 42\n" | jexec alcatraz pfctl -f -
+	atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \
+		--sendif ${epair_send}a \
+		--to 198.51.100.3 \
+		--recvif ${epair_recv}a \
+		--expect-tos 42
+
+	# Multiple scrub rules match as expected
+	printf "scrub out proto tcp set-tos 13\nscrub out proto icmp set-tos 14\n" \
+		| jexec alcatraz pfctl -f -
+	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
+		--sendif ${epair_send}a \
+		--to 198.51.100.3 \
+		--recvif ${epair_recv}a \
+		--expect-tos 14
+
+	# And this works even if the packet already has ToS values set
+	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
+		--sendif ${epair_send}a \
+		--to 198.51.100.3 \
+		--recvif ${epair_recv}a \
+		--send-tos 42 \
+		--expect-tos 14
+
+	# ToS values are unmolested if the packets do not match a scrub rule
+	printf "scrub out proto tcp set-tos 13\n" \
+		| jexec alcatraz pfctl -f -
+	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
+		--sendif ${epair_send}a \
+		--to 198.51.100.3 \
+		--recvif ${epair_recv}a \
+		--send-tos 42 \
+		--expect-tos 42
+}
+
+v4_cleanup()
+{
+	pft_cleanup
+}
+
+atf_init_test_cases()
+{
+	atf_add_test_case "v4"
+}